[runtime] Cleanup the way we create prototypes for builtin functions.

Pass the_hole_value as a |prototype| to let the helper function create
prototype object and properly wire it with the respective constructor
function.

Bug: v8:6459
Change-Id: I85097c02c88f00a47e62321ee3e6a3bdf6b5bcf8
Reviewed-on: https://chromium-review.googlesource.com/557799Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46341}

src/bootstrapper.cc

@@ -1147,10 +1147,9 @@ static void InstallError(Isolate* isolate, Handle<JSObject> global,
                          Handle<String> name, int context_index) {
   Factory* factory = isolate->factory();
 
-  Handle<JSFunction> error_fun =
-      InstallFunction(global, name, JS_ERROR_TYPE, JSObject::kHeaderSize,
-                      isolate->initial_object_prototype(),
-                      Builtins::kErrorConstructor, DONT_ENUM);
+  Handle<JSFunction> error_fun = InstallFunction(
+      global, name, JS_ERROR_TYPE, JSObject::kHeaderSize,
+      factory->the_hole_value(), Builtins::kErrorConstructor, DONT_ENUM);
   error_fun->shared()->set_instance_class_name(*factory->Error_string());
   error_fun->shared()->DontAdaptArguments();
   error_fun->shared()->set_construct_stub(
@@ -1165,14 +1164,12 @@ static void InstallError(Isolate* isolate, Handle<JSObject> global,
   InstallWithIntrinsicDefaultProto(isolate, error_fun, context_index);
 
   {
-    Handle<JSObject> prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
+    // Setup %XXXErrorPrototype%.
+    Handle<JSObject> prototype(JSObject::cast(error_fun->instance_prototype()));
 
     JSObject::AddProperty(prototype, factory->name_string(), name, DONT_ENUM);
     JSObject::AddProperty(prototype, factory->message_string(),
                           factory->empty_string(), DONT_ENUM);
-    JSObject::AddProperty(prototype, factory->constructor_string(), error_fun,
-                          DONT_ENUM);
 
     if (context_index == Context::ERROR_FUNCTION_INDEX) {
       Handle<JSFunction> to_string_fun =
@@ -1194,8 +1191,6 @@ static void InstallError(Isolate* isolate, Handle<JSObject> global,
                                      false, Object::THROW_ON_ERROR)
                 .FromMaybe(false));
     }
-
-    JSFunction::SetPrototype(error_fun, prototype);
   }
 
   Handle<Map> initial_map(error_fun->initial_map());
@@ -1399,8 +1394,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     class_function_map_->SetConstructor(*function_fun);
   }
 
-  {
-    // --- A s y n c F r o m S y n c I t e r a t o r
+  {  // --- A s y n c F r o m S y n c I t e r a t o r
     Handle<Code> code = isolate->builtins()->AsyncIteratorValueUnwrap();
     Handle<SharedFunctionInfo> info =
         factory->NewSharedFunctionInfo(factory->empty_string(), code, false);
@@ -1916,13 +1910,10 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
         string_iterator_function->initial_map());
   }
 
-  {
-    // --- S y m b o l ---
-    Handle<JSObject> prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
-    Handle<JSFunction> symbol_fun =
-        InstallFunction(global, "Symbol", JS_VALUE_TYPE, JSValue::kSize,
-                        prototype, Builtins::kSymbolConstructor);
+  {  // --- S y m b o l ---
+    Handle<JSFunction> symbol_fun = InstallFunction(
+        global, "Symbol", JS_VALUE_TYPE, JSValue::kSize,
+        factory->the_hole_value(), Builtins::kSymbolConstructor);
     symbol_fun->shared()->SetConstructStub(
         *isolate->builtins()->SymbolConstructor_ConstructStub());
     symbol_fun->shared()->set_length(0);
@@ -1953,16 +1944,16 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     InstallConstant(isolate, symbol_fun, "unscopables",
                     factory->unscopables_symbol());
 
+    // Setup %SymbolPrototype%.
+    Handle<JSObject> prototype(
+        JSObject::cast(symbol_fun->instance_prototype()));
+
     // Install the @@toStringTag property on the {prototype}.
     JSObject::AddProperty(
         prototype, factory->to_string_tag_symbol(),
         factory->NewStringFromAsciiChecked("Symbol"),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
-    // Install the "constructor" property on the {prototype}.
-    JSObject::AddProperty(prototype, factory->constructor_string(), symbol_fun,
-                          DONT_ENUM);
-
     // Install the Symbol.prototype methods.
     SimpleInstallFunction(prototype, "toString",
                           Builtins::kSymbolPrototypeToString, 0, true);
@@ -1984,12 +1975,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // --- D a t e ---
-    // Builtin functions for Date.prototype.
-    Handle<JSObject> prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
     Handle<JSFunction> date_fun =
-        InstallFunction(global, "Date", JS_DATE_TYPE, JSDate::kSize, prototype,
-                        Builtins::kDateConstructor);
+        InstallFunction(global, "Date", JS_DATE_TYPE, JSDate::kSize,
+                        factory->the_hole_value(), Builtins::kDateConstructor);
     InstallWithIntrinsicDefaultProto(isolate, date_fun,
                                      Context::DATE_FUNCTION_INDEX);
     date_fun->shared()->SetConstructStub(
@@ -2002,9 +1990,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     SimpleInstallFunction(date_fun, "parse", Builtins::kDateParse, 1, false);
     SimpleInstallFunction(date_fun, "UTC", Builtins::kDateUTC, 7, false);
 
-    // Install the "constructor" property on the {prototype}.
-    JSObject::AddProperty(prototype, factory->constructor_string(), date_fun,
-                          DONT_ENUM);
+    // Setup %DatePrototype%.
+    Handle<JSObject> prototype(JSObject::cast(date_fun->instance_prototype()));
 
     // Install the Date.prototype methods.
     SimpleInstallFunction(prototype, "toString",
@@ -2135,11 +2122,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // -- P r o m i s e
-    Handle<JSObject> prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
     Handle<JSFunction> promise_fun = InstallFunction(
         global, "Promise", JS_PROMISE_TYPE, JSPromise::kSizeWithEmbedderFields,
-        prototype, Builtins::kPromiseConstructor);
+        factory->the_hole_value(), Builtins::kPromiseConstructor);
     InstallWithIntrinsicDefaultProto(isolate, promise_fun,
                                      Context::PROMISE_FUNCTION_INDEX);
 
@@ -2149,9 +2134,19 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     shared->set_internal_formal_parameter_count(1);
     shared->set_length(1);
 
-    // Install the "constructor" property on the {prototype}.
-    JSObject::AddProperty(prototype, factory->constructor_string(), promise_fun,
-                          DONT_ENUM);
+    InstallSpeciesGetter(promise_fun);
+
+    SimpleInstallFunction(promise_fun, "all", Builtins::kPromiseAll, 1, true);
+
+    SimpleInstallFunction(promise_fun, "resolve", Builtins::kPromiseResolve, 1,
+                          true);
+
+    SimpleInstallFunction(promise_fun, "reject", Builtins::kPromiseReject, 1,
+                          true);
+
+    // Setup %PromisePrototype%.
+    Handle<JSObject> prototype(
+        JSObject::cast(promise_fun->instance_prototype()));
 
     // Install the @@toStringTag property on the {prototype}.
     JSObject::AddProperty(
@@ -2167,15 +2162,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
         prototype, "catch", Builtins::kPromiseCatch, 1, true);
     native_context()->set_promise_catch(*promise_catch);
 
-    InstallSpeciesGetter(promise_fun);
-
-    SimpleInstallFunction(promise_fun, "all", Builtins::kPromiseAll, 1, true);
-
-    SimpleInstallFunction(promise_fun, "resolve", Builtins::kPromiseResolve, 1,
-                          true);
-
-    SimpleInstallFunction(promise_fun, "reject", Builtins::kPromiseReject, 1,
-                          true);
 
     Handle<Map> prototype_map(prototype->map());
     Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate);
@@ -2270,11 +2256,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
   {  // -- R e g E x p
     // Builtin functions for RegExp.prototype.
-    Handle<JSObject> prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
-    Handle<JSFunction> regexp_fun =
-        InstallFunction(global, "RegExp", JS_REGEXP_TYPE, JSRegExp::kSize,
-                        prototype, Builtins::kRegExpConstructor);
+    Handle<JSFunction> regexp_fun = InstallFunction(
+        global, "RegExp", JS_REGEXP_TYPE, JSRegExp::kSize,
+        factory->the_hole_value(), Builtins::kRegExpConstructor);
     InstallWithIntrinsicDefaultProto(isolate, regexp_fun,
                                      Context::REGEXP_FUNCTION_INDEX);
 
@@ -2285,11 +2269,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     shared->set_length(2);
 
     {
-      // RegExp.prototype setup.
-
-      // Install the "constructor" property on the {prototype}.
-      JSObject::AddProperty(prototype, factory->constructor_string(),
-                            regexp_fun, DONT_ENUM);
+      // Setup %RegExpPrototype%.
+      Handle<JSObject> prototype(
+          JSObject::cast(regexp_fun->instance_prototype()));
 
       {
         Handle<JSFunction> fun = SimpleInstallFunction(
@@ -2683,67 +2665,68 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
         factory->NewJSObject(isolate->object_function(), TENURED);
     JSObject::AddProperty(global, name, intl, DONT_ENUM);
 
-    Handle<JSObject> date_time_format_prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
-    // Install the @@toStringTag property on the {prototype}.
-    JSObject::AddProperty(
-        date_time_format_prototype, factory->to_string_tag_symbol(),
-        factory->Object_string(),
-        static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
-    Handle<JSFunction> date_time_format_constructor = InstallFunction(
-        intl, "DateTimeFormat", JS_OBJECT_TYPE, DateFormat::kSize,
-        date_time_format_prototype, Builtins::kIllegal);
-    JSObject::AddProperty(date_time_format_prototype,
-                          factory->constructor_string(),
-                          date_time_format_constructor, DONT_ENUM);
-    native_context()->set_intl_date_time_format_function(
-        *date_time_format_constructor);
-
-    Handle<JSObject> number_format_prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
-    // Install the @@toStringTag property on the {prototype}.
-    JSObject::AddProperty(
-        number_format_prototype, factory->to_string_tag_symbol(),
-        factory->Object_string(),
-        static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
-    Handle<JSFunction> number_format_constructor = InstallFunction(
-        intl, "NumberFormat", JS_OBJECT_TYPE, NumberFormat::kSize,
-        number_format_prototype, Builtins::kIllegal);
-    JSObject::AddProperty(number_format_prototype,
-                          factory->constructor_string(),
-                          number_format_constructor, DONT_ENUM);
-    native_context()->set_intl_number_format_function(
-        *number_format_constructor);
-
-    Handle<JSObject> collator_prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
-    // Install the @@toStringTag property on the {prototype}.
-    JSObject::AddProperty(
-        collator_prototype, factory->to_string_tag_symbol(),
-        factory->Object_string(),
-        static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
-    Handle<JSFunction> collator_constructor =
-        InstallFunction(intl, "Collator", JS_OBJECT_TYPE, Collator::kSize,
-                        collator_prototype, Builtins::kIllegal);
-    JSObject::AddProperty(collator_prototype, factory->constructor_string(),
-                          collator_constructor, DONT_ENUM);
-    native_context()->set_intl_collator_function(*collator_constructor);
-
-    Handle<JSObject> v8_break_iterator_prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
-    // Install the @@toStringTag property on the {prototype}.
-    JSObject::AddProperty(
-        v8_break_iterator_prototype, factory->to_string_tag_symbol(),
-        factory->Object_string(),
-        static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
-    Handle<JSFunction> v8_break_iterator_constructor = InstallFunction(
-        intl, "v8BreakIterator", JS_OBJECT_TYPE, V8BreakIterator::kSize,
-        v8_break_iterator_prototype, Builtins::kIllegal);
-    JSObject::AddProperty(v8_break_iterator_prototype,
-                          factory->constructor_string(),
-                          v8_break_iterator_constructor, DONT_ENUM);
-    native_context()->set_intl_v8_break_iterator_function(
-        *v8_break_iterator_constructor);
+    {
+      Handle<JSFunction> date_time_format_constructor = InstallFunction(
+          intl, "DateTimeFormat", JS_OBJECT_TYPE, DateFormat::kSize,
+          factory->the_hole_value(), Builtins::kIllegal);
+      native_context()->set_intl_date_time_format_function(
+          *date_time_format_constructor);
+
+      Handle<JSObject> prototype(
+          JSObject::cast(date_time_format_constructor->prototype()), isolate);
+
+      // Install the @@toStringTag property on the {prototype}.
+      JSObject::AddProperty(
+          prototype, factory->to_string_tag_symbol(), factory->Object_string(),
+          static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+    }
+
+    {
+      Handle<JSFunction> number_format_constructor = InstallFunction(
+          intl, "NumberFormat", JS_OBJECT_TYPE, NumberFormat::kSize,
+          factory->the_hole_value(), Builtins::kIllegal);
+      native_context()->set_intl_number_format_function(
+          *number_format_constructor);
+
+      Handle<JSObject> prototype(
+          JSObject::cast(number_format_constructor->prototype()), isolate);
+
+      // Install the @@toStringTag property on the {prototype}.
+      JSObject::AddProperty(
+          prototype, factory->to_string_tag_symbol(), factory->Object_string(),
+          static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+    }
+
+    {
+      Handle<JSFunction> collator_constructor =
+          InstallFunction(intl, "Collator", JS_OBJECT_TYPE, Collator::kSize,
+                          factory->the_hole_value(), Builtins::kIllegal);
+      native_context()->set_intl_collator_function(*collator_constructor);
+
+      Handle<JSObject> prototype(
+          JSObject::cast(collator_constructor->prototype()), isolate);
+
+      // Install the @@toStringTag property on the {prototype}.
+      JSObject::AddProperty(
+          prototype, factory->to_string_tag_symbol(), factory->Object_string(),
+          static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+    }
+
+    {
+      Handle<JSFunction> v8_break_iterator_constructor = InstallFunction(
+          intl, "v8BreakIterator", JS_OBJECT_TYPE, V8BreakIterator::kSize,
+          factory->the_hole_value(), Builtins::kIllegal);
+      native_context()->set_intl_v8_break_iterator_function(
+          *v8_break_iterator_constructor);
+
+      Handle<JSObject> prototype(
+          JSObject::cast(v8_break_iterator_constructor->prototype()), isolate);
+
+      // Install the @@toStringTag property on the {prototype}.
+      JSObject::AddProperty(
+          prototype, factory->to_string_tag_symbol(), factory->Object_string(),
+          static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+    }
   }
 #endif  // V8_INTL_SUPPORT
 
@@ -2808,22 +2791,19 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // -- T y p e d A r r a y
-    Handle<JSObject> prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
-    native_context()->set_typed_array_prototype(*prototype);
-
     Handle<JSFunction> typed_array_fun =
         CreateFunction(isolate, factory->InternalizeUtf8String("TypedArray"),
-                       JS_TYPED_ARRAY_TYPE, JSTypedArray::kSize, prototype,
-                       Builtins::kIllegal);
+                       JS_TYPED_ARRAY_TYPE, JSTypedArray::kSize,
+                       factory->the_hole_value(), Builtins::kIllegal);
     typed_array_fun->shared()->set_native(false);
     InstallSpeciesGetter(typed_array_fun);
-
-    // Install the "constructor" property on the {prototype}.
-    JSObject::AddProperty(prototype, factory->constructor_string(),
-                          typed_array_fun, DONT_ENUM);
     native_context()->set_typed_array_function(*typed_array_fun);
 
+    // Setup %TypedArrayPrototype%.
+    Handle<JSObject> prototype(
+        JSObject::cast(typed_array_fun->instance_prototype()));
+    native_context()->set_typed_array_prototype(*prototype);
+
     // Install the "buffer", "byteOffset", "byteLength" and "length"
     // getters on the {prototype}.
     SimpleInstallGetter(prototype, factory->buffer_string(),
@@ -2921,12 +2901,10 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // -- D a t a V i e w
-    Handle<JSObject> prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
-    Handle<JSFunction> data_view_fun =
-        InstallFunction(global, "DataView", JS_DATA_VIEW_TYPE,
-                        JSDataView::kSizeWithEmbedderFields, prototype,
-                        Builtins::kDataViewConstructor);
+    Handle<JSFunction> data_view_fun = InstallFunction(
+        global, "DataView", JS_DATA_VIEW_TYPE,
+        JSDataView::kSizeWithEmbedderFields, factory->the_hole_value(),
+        Builtins::kDataViewConstructor);
     InstallWithIntrinsicDefaultProto(isolate, data_view_fun,
                                      Context::DATA_VIEW_FUN_INDEX);
     data_view_fun->shared()->SetConstructStub(
@@ -2934,16 +2912,16 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     data_view_fun->shared()->set_length(3);
     data_view_fun->shared()->DontAdaptArguments();
 
+    // Setup %DataViewPrototype%.
+    Handle<JSObject> prototype(
+        JSObject::cast(data_view_fun->instance_prototype()));
+
     // Install the @@toStringTag property on the {prototype}.
     JSObject::AddProperty(
         prototype, factory->to_string_tag_symbol(),
         factory->NewStringFromAsciiChecked("DataView"),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
-    // Install the "constructor" property on the {prototype}.
-    JSObject::AddProperty(prototype, factory->constructor_string(),
-                          data_view_fun, DONT_ENUM);
-
     // Install the "buffer", "byteOffset" and "byteLength" getters
     // on the {prototype}.
     SimpleInstallGetter(prototype, factory->buffer_string(),
@@ -3002,11 +2980,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
       index_string->set_hash_field(field);
     }
 
-    Handle<JSObject> prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
     Handle<JSFunction> js_map_fun =
-        InstallFunction(global, "Map", JS_MAP_TYPE, JSMap::kSize, prototype,
-                        Builtins::kMapConstructor);
+        InstallFunction(global, "Map", JS_MAP_TYPE, JSMap::kSize,
+                        factory->the_hole_value(), Builtins::kMapConstructor);
     InstallWithIntrinsicDefaultProto(isolate, js_map_fun,
                                      Context::JS_MAP_FUN_INDEX);
 
@@ -3016,9 +2992,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     shared->DontAdaptArguments();
     shared->set_length(0);
 
-    // Install the "constructor" property on the {prototype}.
-    JSObject::AddProperty(prototype, factory->constructor_string(), js_map_fun,
-                          DONT_ENUM);
+    // Setup %MapPrototype%.
+    Handle<JSObject> prototype(
+        JSObject::cast(js_map_fun->instance_prototype()));
 
     // Install the @@toStringTag property on the {prototype}.
     JSObject::AddProperty(
@@ -3042,11 +3018,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // -- S e t
-    Handle<JSObject> prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
     Handle<JSFunction> js_set_fun =
-        InstallFunction(global, "Set", JS_SET_TYPE, JSSet::kSize, prototype,
-                        Builtins::kSetConstructor);
+        InstallFunction(global, "Set", JS_SET_TYPE, JSSet::kSize,
+                        factory->the_hole_value(), Builtins::kSetConstructor);
     InstallWithIntrinsicDefaultProto(isolate, js_set_fun,
                                      Context::JS_SET_FUN_INDEX);
 
@@ -3056,9 +3030,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     shared->DontAdaptArguments();
     shared->set_length(0);
 
-    // Install the "constructor" property on the {prototype}.
-    JSObject::AddProperty(prototype, factory->constructor_string(), js_set_fun,
-                          DONT_ENUM);
+    // Setup %SetPrototype%.
+    Handle<JSObject> prototype(
+        JSObject::cast(js_set_fun->instance_prototype()));
 
     // Install the @@toStringTag property on the {prototype}.
     JSObject::AddProperty(
@@ -3122,14 +3096,13 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // -- W e a k M a p
-    Handle<JSFunction> js_weak_map_fun =
+    Handle<JSFunction> cons =
         InstallFunction(global, "WeakMap", JS_WEAK_MAP_TYPE, JSWeakMap::kSize,
                         factory->the_hole_value(), Builtins::kIllegal);
-    InstallWithIntrinsicDefaultProto(isolate, js_weak_map_fun,
+    InstallWithIntrinsicDefaultProto(isolate, cons,
                                      Context::JS_WEAK_MAP_FUN_INDEX);
     // Setup %WeakMapPrototype%.
-    Handle<JSObject> prototype(JSObject::cast(js_weak_map_fun->prototype()),
-                               isolate);
+    Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()));
 
     JSObject::AddProperty(
         prototype, factory->to_string_tag_symbol(),
@@ -3138,14 +3111,13 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // -- W e a k S e t
-    Handle<JSFunction> js_weak_set_fun =
+    Handle<JSFunction> cons =
         InstallFunction(global, "WeakSet", JS_WEAK_SET_TYPE, JSWeakSet::kSize,
                         factory->the_hole_value(), Builtins::kIllegal);
-    InstallWithIntrinsicDefaultProto(isolate, js_weak_set_fun,
+    InstallWithIntrinsicDefaultProto(isolate, cons,
                                      Context::JS_WEAK_SET_FUN_INDEX);
     // Setup %WeakSetPrototype%.
-    Handle<JSObject> prototype(JSObject::cast(js_weak_set_fun->prototype()),
-                               isolate);
+    Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()));
 
     JSObject::AddProperty(
         prototype, factory->to_string_tag_symbol(),
@@ -3744,10 +3716,7 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
     // Builtin functions for Script.
     Handle<JSFunction> script_fun = InstallFunction(
         container, "Script", JS_VALUE_TYPE, JSValue::kSize,
-        isolate->initial_object_prototype(), Builtins::kUnsupportedThrower);
-    Handle<JSObject> prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
-    JSFunction::SetPrototype(script_fun, prototype);
+        factory->the_hole_value(), Builtins::kUnsupportedThrower);
     native_context->set_script_function(*script_fun);
 
     Handle<Map> script_map = Handle<Map>(script_fun->initial_map());
@@ -3954,15 +3923,14 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
 
     Handle<JSFunction> callsite_fun = InstallFunction(
         container, "CallSite", JS_OBJECT_TYPE, JSObject::kHeaderSize,
-        isolate->initial_object_prototype(), Builtins::kUnsupportedThrower);
+        factory->the_hole_value(), Builtins::kUnsupportedThrower);
     callsite_fun->shared()->DontAdaptArguments();
     isolate->native_context()->set_callsite_function(*callsite_fun);
 
     {
-      Handle<JSObject> proto =
-          factory->NewJSObject(isolate->object_function(), TENURED);
-      JSObject::AddProperty(proto, factory->constructor_string(), callsite_fun,
-                            DONT_ENUM);
+      // Setup CallSite.prototype.
+      Handle<JSObject> prototype(
+          JSObject::cast(callsite_fun->instance_prototype()));
 
       struct FunctionInfo {
         const char* name;
@@ -3993,10 +3961,8 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
 
       Handle<JSFunction> fun;
       for (const FunctionInfo& info : infos) {
-        SimpleInstallFunction(proto, info.name, info.id, 0, true, attrs);
+        SimpleInstallFunction(prototype, info.name, info.id, 0, true, attrs);
       }
-
-      JSFunction::SetPrototype(callsite_fun, proto);
     }
   }
   isolate->native_context()->set_exports_container(*container);

src/js/messages.js

@@ -22,8 +22,6 @@ var Script = utils.ImportNow("Script");
  * Set up the Script function and constructor.
  */
 %FunctionSetInstanceClassName(Script, 'Script');
-%AddNamedProperty(Script.prototype, 'constructor', Script,
-                  DONT_ENUM | DONT_DELETE | READ_ONLY);
 
 
 /**